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REMARKS 

In the Non-Final Office Action dated November 17, 2005, claims 1-26 and 32 are 
pending in the application, and claims 1-26 and 32 are rejected. In particular, claims 1, 2, 6-8, 
10-12, 15, 16, 24-26, and 32 are rejected under 35 U.S.C. §102(e) over U.S. 5,991,881 to 
Conklin et al ("Conklin"), claims 3, 4, 9, and 13 are rejected under 35 U.S.C. 103(a) over 
Conklin in view of U.S. 6,529,515 to Raz et al ("Raz"), claims 5 and 14 are rejected under 35 
U.S.C. 103(a) over Conklin in view of Applied Cryptograph ("Schneier"), and claims 17-23 are 
rejected under 35 U.S.C. § 103(a) over Conklin in view of U.S. 4,947,430 to Chaum ("Chaum"). 
Applicant amends claim 32 to correct matters of form. No new matter is added. 

Applicant notes that the rejections of at least claims 2, 8, and 17-23 reference incorrect 
passages of Conklin. Applicants appreciatively acknowledge the telephone discussion with 
Examiner Moorthy on February 15, 2006, in which the Examiner was able to identify the source 
of the discrepancy. Should the rejections to these claims be maintained, Applicants respectfully 
request any subsequent action include reference the intended passages of Conklin. 

The Action rejects claim 1 as being unpatentable over Conklin. Applicant traverses the 
rejection. Claim 1 recites a router that evaluates an excising signal which "indicates] that [a] 
network control computer has determined that an untrusted party has gained control of a first 
functioning router of the plurality of routers and is to be excised from the network." Conklin 
does not describe such a signal. The Action asserts that Conklin teaches this subject matter at 
column 5 line 46 to column 6 line 18. Applicant respectfully disagrees. The cited passage is 
generally directed to a Send Alert Message formatted into IEEE standard Simple Network 
Management Protocol (SNMP) data packets, referred to as Trap PDUs. The Trap PDUs are used 
to provide a remote network management station with a notification of a significant event, such 
as an unauthorized event or series of events indicating an unauthorized activity. 

According to the cited passage, the Trap PDU includes the following fields: 

• PDU type: indicates a GetRequest PDU 

• Enterprise: identifies the system that generated the trap 

• Agent-address: IP address of the object generating the trap 

• Generic-trap: one of the predefined trap types 

• Specific-trap: a code that indicates more specifically the nature of the trap 

9935709 1.DOC 11 



Application No.: 09/596,009 Attorney Docket No. :BBNT-P0 1-007 

Amendment dated: February 1 7, 2006 

Reply to Office Action of: November 17, 2005 

• Time-stamp: time of the generation of the trap 

• Variable-bindings: implementation specific information relating to the trap 

Notably, this set of fields does not include a field which indicates that a router is to be 
excised from a network. Yet this is the explicit subject matter of claim 1 . 

Claim 1 further recites a router that "reroutes the excising signal to at least a 
second router of the plurality of routers." The Action asserts that this subject matter is 
described at column 5 line 46 to column 6 line 1 8 of Conklin. Conklin states at column 5 
lines 55-60 that the Send Alert Notification may be transmitted to a network management 
system, and at column 6 lines 10-15 that: 

"Responses to an attack include a description of the identified event with 
the attacking network address, targeted network address and a date/time 
stamp. This information . . . can be configured to send to any number of 
remote SNMP monitoring systems." 

This passage describes a single system sending out one or more responses. It does not 
describe a recipient of an excising signal redistributing that signal to other routers, as 
explicitly recited in claim 1 . 

For the above reasons. Applicant requests withdrawal of the § 102(e) rejection of this 
claim. Claims 2-6 depend from claim 1 and add further restrictions and limitations thereto. 
Therefore, Applicant requests reconsideration and withdrawal of the rejections to these claims. 
Since independent claims 7, 16, 17, 22, and 24-26 include similar subject matter to claim 1 
(claim 1 6 relates to distributing the excising signal to a second cluster head or member, claim 24 
recites "rerouting" the excising signal, and claims 25-26 recite "cut-off signals), Applicant 
requests reconsideration and withdrawal of the rejections to these independent claims. Claims 8- 
15, 18-21, and 23 depend, directly or indirectly, from these independent claims. Thus, Applicant 
requests reconsideration and withdrawal of the rejections to these claims. 

Amended independent claim 32 is rejected under 35 U.S.C. §102(e) as being 
unpatentable over Conklin. Applicant traverses the rejection. Amended claim 32 recites 
computer executable code including "code to reinstate an excised router when a trusted party 
regains control of the excised router." The Action asserts that Conklin teaches reinstating 
excised routers at column 5 line 46 to column 6 line 18. Applicant respectfully disagrees. As 
noted above, the cited passage is generally directed to a Trap PDU alert notification. The 
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passage fails to disclose or suggest reinstating a compromised system when a trusted party 
regains control of the compromised system. In particular, Conklin makes no mention of a 
trusted party regaining control of a compromised system. Therefore, Applicant requests 
reconsideration and withdrawal of the § 102(e) rejection of this claim. 

In view of the above remarks, Applicants believe the pending application is in condition 
for allowance. 
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Applicant believes no fee is due with this response. However, if any fee is due, please 
charge our Deposit Account No. 18-1945, under Order No. BBNT-P01-007 from which the 
undersigned is authorized to draw. 



Dated: February 17, 2006 




Respectfully submitted, 

By. 

Edwa^l Gordon 

Registration No.: 54,130 
ROPES & GRAY LLP 
One International Place 
Boston, Massachusetts 02110-2624 
(617) 951-7000 
(617) 951-7050 (Fax) 
Attorneys/ Agents For Applicant 
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